Socket researcher Kush Pandya found 13 malicious Composer theme packages on Packagist, spread across five vendor namespaces — vsmov, vsphim, haiau009, chilltvcms and ophimcms. It is an escalation of a campaign first seen with six packages in March 2026; the iOS chain was redeployed around 12 August 2026.

The path is worth stating in full because of how far it travels.

A PHP package, then someone else's phone

The themes are installed by operators of Vietnamese streaming sites. The theme injects JavaScript. Visitors to those sites get a mobile ad-fraud and gambling-redirect chain — and on iPhones, a WebKit-to-kernel exploit chain that installs spyware.

Nobody in that sequence is the attacker's actual target except the last person. The site operator installing a theme is thinking about layout. The visitor is watching a video.

Supply-chain compromise usually means the consumer of the package is the victim. Here the package consumer is a delivery mechanism, and the victims are people who have never heard of Composer. That is a different shape, and the browser-extension campaign where five of nineteen extensions were bought from their original developers is the closest recent parallel — a legitimate distribution channel pointed at its own audience.

The chain

The exploit pivots from the WebContent sandbox into the GPU process, then reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client.

It uses two WebKit flaws: CVE-2025-31277, patched in iOS 18.6, and CVE-2025-43529, patched in iOS 18.7.3 and 26.2. The kernel escape is not firmly identified — Socket's report leaves attribution among CVE-2025-43398, CVE-2025-43510 and CVE-2025-43520 unconfirmed, and notes Apple assigned no CVE for the specific issue, which was already fixed in iOS 26.1.

The campaign targets iOS 18.4 through 18.6.x.

Every vulnerability in this chain has a fix, and several were fixed before the campaign redeployed. This is not a zero-day operation. It is an operation against phones that did not update, and the version range tells you the operators knew exactly which population they were farming.

What it takes

The payload collects keychains, Wi-Fi passwords, SMS databases, address books, photos, browser cookies, call history, location history and account databases — then cryptocurrency wallet seeds from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX.

Everything is AES-encrypted and posted over HTTPS to rotating command-and-control domains.

The wallet list is the tell. Everything before it is generic surveillance loot; seed phrases are the part that converts directly to money, and their presence is what makes the whole chain worth building.

On the attribution

Socket assesses the group as Vietnamese-operated, and the basis given is commit metadata timestamps.

Say plainly what that is: an inference from when commits were authored, which is a timezone signal. It is consistent with the targeting — Vietnamese streaming sites — and it is not identification. Timestamps are trivially forgeable and routinely misleading, and this site has declined to convert weaker signals than this into nationality before.

The infrastructure detail is firmer: hosting is attributed to Funnull, an entity sanctioned by the United States in May 2025 for facilitating romance scams tied to over $200 million in cryptocurrency losses.

What to do

  • Update iOS. The entire chain dies on a current version, and the targeted range ends at 18.6.x.
  • Audit Composer dependencies for themes, particularly from unfamiliar vendor namespaces. A theme is code.
  • If you run a site on a third-party theme, you are shipping its JavaScript to your visitors. Their exposure is your responsibility even when your server is untouched.
  • Move wallet seeds off any device that browses the general internet. The specific wallets named are the ones with the best market share, not the ones with the worst security.
  • Do not rely on package-registry reputation. Five namespaces, thirteen packages, and a prior round in March that did not stop the second.

What is not established

  • How many sites installed the themes, or how many visitors were exposed. No download counts are published.
  • Which kernel flaw is actually used. Three candidates, none confirmed, and Apple issued no CVE.
  • Whether the packages have been removed from Packagist.
  • Who the operators are. Timezone inference from commit metadata is not attribution.
  • Whether the ad-fraud and the spyware are the same operation or a shared delivery channel sold on.